28% of respondents at middle market organisations said their existing security measures were partially successful against ransomware attacks.

X-Force observed a decline in ransomware incidents overall for the third year.

Analysis of dark web data reveals a 25% increase in ransomware activity year-over-year.

Extortion following a ransom demand occurred in 12% of cases.

Among middle market companies that experienced at least one ransomware attack, 31% said existing security measures were unsuccessful.

Ransomware comprises nearly one-third (28%) of malware incident response cases and 11% of security cases.

35% of respondents in larger middle market companies reported at least one ransomware attack or request.

15% of smaller middle market organisations reported at least one ransomware attack or request.

Ransomware made up 28% of malware cases in 2024.

Manufacturing had the highest number of ransomware cases in 2024.

25% of surveyed executives at middle market organisations reported experiencing at least one ransomware attack or demand in the previous 12 months.

Use of remote ransomware increased 141 percent since 2022.

Ransomware cases accounted for over 90 percent of Sophos Incident Response cases for midsized organisations (from 500 to 5000 employees) in 2024.

The use of remote ransomware increased 50 percent in 2024 over last year, and 141 percent since 2022.

Ransomware and data theft attempts accounted for nearly 30 percent of all Sophos Managed Detection and Response (MDR) tracked incidents (in which malicious activity of any sort was detected) for small and midsized businesses.

EDRSandBlast variants were detected in waves of attempted ransomware attacks throughout 2024, including a dramatic peak around the US Thanksgiving holiday in November

Ransomware cases accounted for 70 percent of Sophos Incident Response cases for small business customers in 2024.

Use of remote ransomware increased 50 percent in 2024 over last year.

The average price of "junk gun" ransomware obtained from an underground marketplace is $375.

Most active STAC campaigns tracked by Sophos MDR in 2024 were ransomware-related.